[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 15 Jun 2011 09:49:20 +0200
From: Ludwig Nussel <ludwig.nussel@...e.de>
To: oss-security@...ts.openwall.com
Cc: Nicolas François <nekral.lists@...il.com>,
Ondřej Vašík <ovasik@...hat.com>
Subject: Re: /bin/su (was: CVE request -- coreutils -- tty hijacking possible in "su" via TIOCSTI ioctl)
Bernhard Rosenkraenzer wrote:
> On Friday, June 10, 2011 11:55 CEST, Ludwig Nussel <ludwig.nussel@...e.de> wrote:
>
> > The issue also reminds me that there are several su implemenations.
> > On Fedora and SUSE we have a patched coreutils version, Debian uses
> > the one from shadow-utils and then there's also a su from
> > SimplePAMApps, used by e.g. Owl. Of course each one has it's own
> > quirks and weird features. Does anyone still remember why a
> > particular implementation was chosen? :-)
>
>
> In Ark Linux, we switched from the coreutils one to the shadow-utils one
> about 2 years ago because the shadow-utils one does what we need (incl. PAM
> support) without having to port the PAM patch on every new coreutils release.
Upstream coreutils indicated that they consider su in coreutils kind
of deprecated, basically only kept for legacy reasons on non-Linux
OSes. They would accept the PAM patch though so distros don't need
to maintain it.
Is there actually any serious distro that doesn't use PAM though?
Those #ifdefs to keep old shadow compatibility makes the code rather
ugly and hard to read. Maybe it's time to just rip out the old code
and submit a clean, PAM only su to util-linux.
cu
Ludwig
--
(o_ Ludwig Nussel
//\
V_/_ http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
